Sentry 9.2 ignores allowUrls and reports errors anyway

[patroza]

Is there an existing issue for this?

• I have checked for existing issues https://github.com/getsentry/sentry-javascript/issues
• I have reviewed the documentation https://docs.sentry.io/
• I am using the latest SDK release https://github.com/getsentry/sentry-javascript/releases

How do you use Sentry?

Sentry Saas (sentry.io)

Which SDK are you using?

@sentry/browser

SDK Version

9.2.0

Framework Version

No response

Link to Sentry event

https://macs-holding.sentry.io/issues/6317718880/events/d9099849308c471aab0ac0a2c05ed783/?project=4504671195299840

Reproduction Example/SDK Setup

Sentry.init({
  ...,
  allowUrls: ["https://" + window.location.host]
})

Steps to Reproduce

Error happens in 3rd party script

Expected Result

No report

Actual Result

Got report

[lforst]

The event you linked is on version 9.1.0 but in your issue you state 9.2.0 has an issue. Is it possible the error is coming from an old deployment/old site on somebody's device?

[patroza]

@lforst the behavior is equal: https://macs-holding.sentry.io/issues/6317718880/events/latest/?project=4504671195299840&referrer=latest-event

[lforst]

Alright, we gotta dig deeper. Would you mind sharing the rest of your Sentry init? Thanks!

[lforst]

Oh damn I found the issue but it's super fucky and I would have never thought of this. Basically, the issues you linked contain two "linked" exceptions. The root exception is the one you wanted to ignore and the other one (its cause) is an AbortError. In the logic in the SDK we always only check the first recorded exception which in this case is the cause, which doesn't have a stack trace.

We'll do two things:

• I am gonna adjust the logic for allowUrls to account for this. Haven't decided yet on whether we should make it depend on the top frame of all linked exceptions, or whether we should only apply it to the "main" exception.
• I will talk with the UI team to actually show the "linked" exceptions if they don't contain the stacktrace. This is just garbage UX otherwise.